Overview: Policy Enforcement Point (PEP)

Quick Definition

A Policy Enforcement Point is a system component that actively enforces access control policies by intercepting and evaluating requests for protected resources. When a user or application attempts to access a resource, the PEP captures this request and communicates with a Policy Decision Point (PDP) to determine whether the access should be granted or denied based on established security policies.

The PEP serves as the gatekeeper in attribute-based access control (ABAC) and other policy-driven security frameworks, acting as the intermediary between users and the resources they seek to access. It does not make authorization decisions itself but rather relies on the PDP to evaluate the request against relevant policies, user attributes, environmental factors, and resource characteristics.

Common examples of Policy Enforcement Points include web application firewalls, API gateways, network access control devices, and database security proxies. These systems intercept requests, forward policy evaluation queries to decision points, receive authorization decisions, and then either permit or block the requested action accordingly.

The effectiveness of a PEP depends on its ability to consistently intercept all relevant access attempts and properly communicate with policy decision components, making it a critical element in comprehensive access control architectures.